DNSSEC an introduction ccTLD workshop November 26-29th, 2007 Amman, Jordan Based on slides from RIPE NCC

Overview DNS Vulnerabilities DNSSEC Mechanisms New Resource Records Setting Up a Secure Zone Delegating Signing Authority Key Rollovers Operational Concerns

DNS Vulnerabilities

caching forwarder (recursive resolver)‏ ask ripe.net nameservers DNS Resolving caching forwarder (recursive resolver)‏ www.ripe.net A root server ask .net nameservers stub resolver www.ripe.net A www.ripe.net A gtld server 193.0.0.203 ask ripe.net nameservers www.ripe.net A RIPE server 193.0.0.203 Question Answer

DNS Data Flow Zone file Caching fowarder Resolver Master Dynamic updates Slaves

DNS Vulnerabilities Zone file Caching fowarder Resolver Master corrupting data cache pollution by data spoofing cache impersonation Zone file Master Caching fowarder Resolver Dynamic updates Slaves unauthorised updates impersonating master altered zone data cache pollution by data spoofing server protection data protection

Mail goes to the server in the MX resource record DNS Exploit Example Mail goes to the server in the MX resource record Path only visible in email headers resolver MX RR Black Hat MX RR MX RR sending mail server receiving mail server Question Answer Spoofed answer

Other Possible DNS Targets SPF, DomainKey and family Technologies that use the DNS to mitigate spam and phishing: $$$ value for the black hats StockTickers, RSS feeds Usually no source authentication but supplying false stock information through a stockticker and a news feed can have $$$ value ENUM Mapping telephone numbers to services in the DNS As soon as there is some incentive

Mitigate by Deploying SSL?

Mitigate by Deploying SSL? Claim: SSL is not the magic bullet (Neither is DNSSEC)‏ Problem: Users are offered a choice Far too often Users are annoyed Implementation and use make SSL vulnerable Not the technology

Where Does DNSSEC Come In? DNSSEC secures the name to address mapping Before the certificates are needed DNSSEC provides an “independent” trust path The person administering “https” is most probably a different from person from the one that does “DNSSEC” The chains of trust are most probably different

Data Origin Authentication Data Integrity DNSSEC Provides Data Origin Authentication Data Integrity Authenticating Name and Type Non-Existence DNSSEC Is not designed to provide confidentiality Provides no protection against denial of service attacks 12

A secure DNS will be used as an infrastructure with public keys DNSSEC Components TSIG/SIG(0): provides mechanisms to authenticate communication between machines DNSKEY/RRSIG/NSEC: provides mechanisms to establish authenticity and integrity of data DS: provides a mechanism to delegate trust to public keys of third parties A secure DNS will be used as an infrastructure with public keys However it is NOT a PKI 13

Questions? Summary DNS introduction DNS vulnerabilities SSL not the complete answer Questions?

DNSSEC Mechanisms New Resource Records Setting Up a Secure Zone Delegating Signing Authority Key Rollovers

DNSSEC Protected Vulnerabilities cache pollution by data spoofing cache impersonation Zone file Master Caching fowarder Resolver Dynamic updates Slaves altered zone data cache pollution by data spoofing

Public DNSKEYs used to verify the RRSIGs DNSSEC hypersummary Data authenticity and integrity by signing the Resource Records Sets with private key Public DNSKEYs used to verify the RRSIGs Children sign their zones with their private key Authenticity of that key established by signature/checksum by the parent (DS)‏ Ideal case: one public DNSKEY distributed 17

DNSSEC summary ripe.net. net. www.ripe.net IN 900 A 193.0.0.214 www.ripe.net IN 900 RRSIG A ... 26523 ripe.net. ... ripe.net IN 3600 DNSKEY 256 3 5 ... ripe.net IN 3600 RRSIG DNSKEY ... 26523 ripe.net. ... net. ripe.net IN 3600 DS 26523 5 1 ... ripe.net IN 3600 RRSIG DS .... 573 net. ... Locally Configured Verifier (named.conf)‏ trusted-keys { “ripe.net." 256 3 5 “..."; };

Security Status of Data (RFC4035)‏ Secure Resolver is able to build a chain of signed DNSKEY and DS RRs from a trusted security anchor to the RRset Insecure Resolver knows that it has no chain of signed DNSKEY and DS RRs from any trusted starting point to the RRset Bogus Resolver believes that it ought to be able to establish a chain of trust but for which it is unable to do so May indicate an attack but may also indicate a configuration error or some form of data corruption Indeterminate Resolver is not able to determine whether the RRset should be signed 19

New Resource Records

name TTL class type rdata www.ripe.net. 7200 IN A 192.168.10.3 RRs and RRSets Resource Record: name TTL class type rdata www.ripe.net. 7200 IN A 192.168.10.3 RRset: RRs with same name, class and type: www.ripe.net. 7200 IN A 192.168.10.3 A 10.0.0.3 A 172.25.215.2 RRSets are signed, not the individual RRs 21

New Resource Records Three Public key crypto related RRs RRSIG Signature over RRset made using private key DNSKEY Public key, needed for verifying a RRSIG DS Delegation Signer; ‘Pointer’ for building chains of authentication One RR for internal consistency NSEC Indicates which name is the next one in the zone and which typecodes are available for the current name authenticated non-existence of data 22

NSEC Records NSEC RR provides proof of non-existence If the servers response is NXDOMAIN: One or more NSEC RRs indicate that the name or a wildcard expansion does not exist If the servers response is NOERROR: And empty answer section The NSEC proves that the QTYPE did not exist More than one NSEC may be required in response Wildcards NSEC records are generated by tools Tools also order the zone 23

NSEC Walk NSEC records allow for zone enumeration Providing privacy was not a requirement Zone enumeration is a deployment barrier Work has started to study solutions Requirements are gathered If and when a solution is developed, it will co-exist with DNSSEC-BIS !

Questions? Summary DNSSEC not a PKI Zone status New RRs: DNSKEY, RRSIG, NSEC, DS Questions?

Setting Up a secure Zone

Include public key (DNSKEY) in zone file Securing a Zone: Step 1 Generate keypair Include public key (DNSKEY) in zone file dnssec-keygen tool comes with BIND 27

RRSIG records (signature over each RRset)‏ DS records (optional)‏ Securing a Zone: Step 2 Sign your zone Signing will: Sort the zone Insert: NSEC records RRSIG records (signature over each RRset)‏ DS records (optional)‏ Generate key-set and ds-set files 28

Signed zone is regular zonefile format With extra resource records Securing a Zone: Step 3 Publish signed zone Signed zone is regular zonefile format With extra resource records Make sure all your servers are DNSSEC capable! 29

Configure forwarding resolver Test Securing a Zone: Step 4 Configure forwarding resolver Test DNSSEC verification only done in resolver! 30

Distribute your public key (DNSKEY)‏ Securing a Zone: Step 5 Distribute your public key (DNSKEY)‏ To parent zone (key-set or ds-set can be used)‏ To everyone that wants/needs you as SEP Make sure to inform everyone of key rollovers! 31

Questions? Summary Generating keys Signing and publishing the zone Resolver configuration Testing the secure zone Questions?

Delegating Signing Authority Chains of Trust

Using the DNS to Distribute Keys Secured islands make key distribution problematic Distributing keys through DNS: Use one trusted key to establish authenticity of other keys Building chains of trust from the root down Parents need to sign the keys of their children Only the root key needed in ideal world Parents always delegate security to child 34

Key Problem Interaction with parent administratively expensive Should only be done when needed Bigger keys are better Signing zones should be fast Memory restrictions Space and time concerns Smaller keys with short lifetimes are better

Key Functions Large keys are more secure Can be used longer ‏ Large signatures => large zonefiles  Signing and verifying computationally expensive  Small keys are fast Small signatures ‏ Signing and verifying less expensive ‏ Short lifetime 

Key solution: More Than One Key RRsets are signed, not RRs DS points to specific key Signature from that key over DNSKEY RRset transfers trust to all keys in DNSKEY RRset Key that DS points to only signs DNSKEY RRset Key Signing Key (KSK)‏ Other keys in DNSKEY RRset sign entire zone Zone Signing Key (ZSK)‏

Walking the Chain of Trust Locally Configured Trusted Key . 8907 (root) . . DNSKEY (…) 5TQ3s… (8907) ; KSK DNSKEY (…) lasE5… (2983) ; ZSK RRSIG DNSKEY (…) 8907 . 69Hw9… net. DS 7834 3 1ab15… RRSIG DS (…) . 2983 net. net. DNSKEY (…) q3dEw… (7834) ; KSK DNSKEY (…) 5TQ3s… (5612) ; ZSK RRSIG DNSKEY (…) 7834 net. cMas… ripe.net. DS 4252 3 1ab15… RRSIG DS (…) net. 5612 ripe.net. ripe.net. DNSKEY (…) rwx002… (4252) ; KSK DNSKEY (…) sovP42… (1111) ; ZSK RRSIG DNSKEY (…) 4252 ripe.net. 5t... www.ripe.net. A 193.0.0.202 RRSIG A (…) 1111 ripe.net. a3...

Questions? Summary Scaling problem: secure islands Zone signing key, key signing key Chain of trust Questions?

Key Rollovers

Key Rollovers Try to minimise impact Short validity of signatures Regular key rollover Remember: DNSKEYs do not have timestamps the RRSIG over the DNSKEY has the timestamp Key rollover involves second party or parties: State to be maintained during rollover Operationally expensive 41

Key Rollover - Summary Generate new KSK Sign with old and new KSKs Wait for your servers + TTL of old DNSKEY RRset Inform resolvers of the new key that have you as a trusted entry point Query for the parental DS and remember the TTL Upload the new KSK or DS to the parent Check if *all* parental servers have new DS Wait another TTL before removing the old key 42

Questions? Summary Key size and signature lifetimes Key rollovers Emergency procedure Questions?

Operational Concerns

Upper Bound

Increased memory, CPU & bandwidth usage Who signs the root zone? Operational Issues Increased memory, CPU & bandwidth usage Who signs the root zone? IANA/ICANN Department of Commerce Verisign No system call for DNSSEC Local verifier on trusted network? End user choice? 46

Questions? Summary Increased memory and bandwidth demands “Political” issues Questions?

The End! הסוף Kрай Y Diwedd Fí Соңы Finis Liðugt Ende Kiнець Konec Fund Kraj Son Kpaj Lõpp Vége An Críoch הסוף Endir Fine Sfârşit Fin Τέλος Einde Конeц Slut Slutt Pabaiga Tmiem Koniec Amaia Loppu Fim